Add a reusable Helm chart lint and publish workflow

[iampopye]

The gap

The Kubernetes workflow applies raw manifests. Most teams past a certain size use Helm, and there is no chart workflow here.

What to build

.github/workflows/kubernetes/reusable-helm-chart.yml covering:

• helm lint
• helm template piped into a policy check (this repo already has an OPA workflow that could be reused)
• helm package
• optional push to an OCI registry (helm push to ghcr.io)
• optional helm upgrade --install --atomic --wait for the deploy path

Design notes

• Keep publish and deploy behind separate boolean inputs, defaulting to false. Matching the existing workflows, the safe path should be the default.
• --atomic matters: without it a failed upgrade leaves the release in a broken half-applied state.
• Prefer OIDC over static registry credentials where the registry supports it.

House rules

SHA-pin third-party actions, start from permissions: {}, document every input. CONTRIBUTING.md has the detail, and CI will tell you if you miss something.

This one is larger than a first issue — comment before starting so effort is not duplicated.